The FFIEC remote deposit capture guidance, "Risk Management of Remote Deposit Capture" (January 14, 2009), tells banks to treat remote deposit capture as a new delivery system with its own risks, to assess those risks before offering it, and to "establish appropriate risk-based guidelines to qualify customers for this service." For a treasury implementation, that means a business client gets a scanner only after a suitability review of its business, controls, location and customer base, a written agreement covering how deposited items are handled and kept, and a plan for monitoring. The work is easy to skip because remote deposit capture looks like an ordinary deposit service; the guidance says it is not. Botminds' Treasury Management Onboarding keeps the information that suitability review needs on the client's implementation, drafts the setup from the signed remote deposit capture schedule, and holds go-live until a test deposit passes and a person has signed.
The guidance is quoted from the FDIC's current copy, revised in June 2026 to remove references to reputational risk. The worked example is a fictional sample client, Halvorsen Freight Systems, a freight carrier ordering remote deposit capture with three other treasury services at a fictional bank.
Is the FFIEC remote deposit capture guidance still in effect?
Yes. The interagency guidance issued through the FFIEC on January 14, 2009 remains the regulators' statement on remote deposit capture risk, and the FDIC's copy carries a note dated this year: "In June 2026, this document was revised to remove references to reputational risk" (FFIEC, Risk Management of Remote Deposit Capture, FDIC copy). The substance on risk assessment, customer suitability, contracts and monitoring is unchanged.
The guidance covers deposit capture at branches, ATMs and correspondents, but its focus is "RDC deployed at a customer location", the treasury product. It also says its principles apply to "mobile banking and automated clearing house [ACH] check conversions", which matters for a bank whose small-business clients deposit by phone rather than by scanner.
What the guidance requires before remote deposit capture goes live
Before remote deposit capture goes live, the guidance expects a risk assessment, policies that set tolerances, customer suitability criteria, a customer contract, training and a monitoring plan. Its framing is the key: "RDC should be viewed as a new delivery system and not simply as a new service. Prior to implementing RDC, senior management should identify and assess the legal, compliance, and operational risks associated with the new system."
Three risk families run through the document. Legal and compliance risk comes from the bank's warranties when it sends the item on, under the Check 21 Act, Regulation CC, Regulation J and state law. BSA/AML risk rises where capture devices sit abroad or clients are higher risk. Operational risk starts "from the point of initial capture", at premises the bank does not control. The conclusion puts it in one line: "As with other financial services, RDC may not be appropriate for all customers or for all financial institutions."
Which customers qualify for remote deposit capture?
The customers that qualify are the ones that meet the bank's own written, risk-based criteria. The guidance sets no list of eligible businesses; it requires the bank to have one and apply it.
Management should establish appropriate risk-based guidelines to qualify customers for this service.
FFIEC, Risk Management of Remote Deposit Capture (2009; FDIC copy revised June 2026)
It also tells the bank where to start: "information gathered while conducting customer identification and customer due diligence procedures in fulfillment of the institution's BSA/AML program can support the assessment of customer suitability." For a treasury client, that information already exists by the time remote deposit capture is configured: the business verification, the beneficial owners under 31 CFR 1010.230, the expected activity. The suitability decision should be made from it, not from a separate questionnaire filled in after the scanner ships.
The suitability review, criterion by criterion
The guidance names what a suitability review covers and how deep it should go. For new and existing customers, it "should involve consideration of the customer's business activities and risk management processes, geographic location, and customer base", and "the depth of such review should be commensurate with the level of risk."
Remote deposit capture suitability: the criteria the guidance names
- Business activities and risk management processes
What the client does and how it controls its own operations. The guidance's examples of higher-risk parties include online payment processors, certain credit-repair services, certain mail and telephone order companies, online gambling operations and businesses located offshore.
- Geographic location
"Additional due diligence may be necessary where there is evidence that the RDC capture device is in a foreign location."
- Customer base
Whose checks the client will deposit. A client depositing for merchants or other customers may be acting, in the guidance's words, effectively as a third-party sender.
- A site visit, when the risk warrants it
To "evaluate management, operational controls and risk management practices, staffing and the need for training and ongoing support, and the IT infrastructure."
- Independent audits, or a self-assessment
Review "available reports of independent audits" at the customer location; for lower risk, the bank "may choose to rely on self-assessments."
- Separation of duties at the client
The guidance warns that "inadequate separation of duties at a customer location can afford an individual end-to-end access to the RDC process."
The examples of higher-risk parties are a starting list, not a prohibition. A bank may serve them with tighter limits and more monitoring, or decide not to; the guidance only requires that the decision follow written criteria and be proportionate. A freight carrier depositing customer payments at its own terminals, like the sample client, sits at the other end of the range.
The same service, sized to two clients
Lower-risk client: Due diligence already on file; a self-assessment of controls at the deposit locations.
Higher-risk client: A site visit to evaluate management, controls, staffing and IT; independent audit reports read.
Lower-risk client: Daily and per-item limits sized to the client's receivables.
Higher-risk client: Lower limits, with velocity and duplicate monitoring from the first day.
Lower-risk client: Standard terms on equipment, item handling, retention and audit.
Higher-risk client: Added rights to mandate controls, audit operations and request information.
Lower-risk client: Exception reports reviewed on the bank's standard cycle.
Higher-risk client: Closer review of duplicates, returns and threshold breaches; earlier reassessment.
Remote deposit capture risk assessment: the customer's location
The risk assessment for remote deposit capture has to reach the client's premises, because that is where the capture happens and where the originals stay. The guidance lists what goes wrong there: "Faulty equipment, inadequate procedures, or inadequate training of customers and their employees can lead to inappropriate document processing, poor image quality, and inaccurate electronic data." Weak controls "may lead to the intentional or unintentional alteration of deposit item information, resubmission of an electronic file, or re-deposit of physical items."
Two risks deserve their own line in any assessment. The guidance treats duplicate presentment, the same check deposited twice, as a process failure and a fraud risk at once (what is duplicate presentment quotes it and follows the loss). And insider fraud may be greater, "because the financial institution typically does not perform background checks on its customers' employees who may have access to physical deposit items or electronic files." For internet-based capture, the guidance also expects "multifactor authentication, layered security, or other controls reasonably calculated to mitigate risks."
Remote deposit capture requirements: what the agreement must cover
The guidance treats the customer agreement as a control in its own right: "RDC agreements should establish the control requirements identified during the risk assessment process and the consequences of noncompliance." It lists the provisions a bank should consider.
Provisions the guidance lists for a remote deposit capture customer agreement
| Provision | What it settles |
|---|---|
| Roles and responsibilities, including equipment and software | Who owns, maintains and updates the scanner and the capture software |
| Handling and record retention procedures | Security for access, transmission, storage and disposal of items holding nonpublic personal information |
| Types of items that may be transmitted | What the client may and may not deposit through the service |
| Processes and procedures, including image quality | What the client must do at capture |
| Items to provide for investigations | Images or originals the client must produce for unusual transactions or disputes |
| Periodic audits, including IT | The bank's right to have the process audited |
| Performance standards | For both the bank and the client |
| Liability, warranties, indemnification, dispute resolution | Who bears which loss |
| Funds availability, collateral, collected funds | Including cut-off times and how the client learns a deposit was accepted |
| Governing laws, regulations and rules | Which law and network rules apply |
| Authority to mandate controls, audit and request information | The bank's right to require controls at the client's locations |
| Authority to terminate | The bank's right to end the service |
The list is also a checklist for the implementation. Each provision the bank includes becomes a setup value, a limit, a cut-off or a control, and each should be traceable from the signed schedule to the configuration. That is the same discipline the ACH origination agreement template applies to ACH.
Remote deposit capture record retention requirements
The guidance does not set a retention period for original checks; it requires the bank to make the client manage them and to say how in the agreement. Because "original deposit items are not submitted to the financial institution but are retained by the customer or the customer's service provider", the bank should "require customers to implement appropriate document management procedures to ensure the safety and integrity of deposited items from the time of receipt until the time of destruction or other voiding." To cut duplicate risk, "deposit items can be endorsed, franked, or otherwise noted as already processed."
Regulation CC adds a financial reason to get this right. A bank that accepts an image deposit, never receives the original and is paid for it indemnifies a bank that later accepts the original over the counter for a loss caused by the check having been paid already. The second bank loses that claim if the original it took carried a restrictive endorsement that did not fit the way it was deposited (12 CFR 229.34(f); the Board's examples are worked through in what is duplicate presentment). A restrictive endorsement at capture, written into the agreement, therefore protects the bank that offers remote deposit capture.
How Treasury Management Onboarding records the decision
In Treasury Management Onboarding, the details a suitability review needs are already on the client's implementation, gathered by the Due Diligence agent from the core banking system, the client record and document imaging: business verification, owners and control person, watch-list screening, adverse media, and the industry and expected activity. A person decides suitability under the bank's criteria; the agents never decide it.
From due diligence to a first remote deposit
Agent
Due Diligence agentAssembles business verification, ownership, screening, adverse media and the client's industry and activity, each from its source system.
Never: decides suitability or releases a hold
A person decides
Suitability decisionA named officer applies the bank's risk-based criteria, decides whether a site visit or self-assessment is needed, and records the decision.
Agent
Setup agentDrafts the deposit capture setup from the signed schedule: locations, devices, limits, cut-off, each citing its page.
Never: writes a live configuration
A person decides
Approval and second checkThe implementation manager approves the setup; a second implementer checks users and limits against the signed forms.
A person decides
Test deposit and go-liveA test deposit is made and checked; a person confirms go-live once every line is signed.
The sample client is a regional freight carrier with payroll and supplier payments only and no cash-intensive activity, depositing at two scanners in terminals 3 and 7. Its business verification confirmed its registration, identification number and 11 terminal addresses against the core banking system and the public register. Its deposit capture schedule, three pages, was signed with the other three schedules on day 1, and the service waited only on its test deposit.
The business checks behind the client, from the systems of record
Remote deposit capture, ready to test beside the other three services
Monitoring after go-live follows the guidance's list: reports on duplicate items, deposit-threshold breaches, velocity in file size, item counts and dollar value, and returns. Where deposit capture fits among the other sign-offs is set out in the treasury management checklist before go-live, and the cost of the days it adds in treasury management onboarding: the steps, the days and their cost. The solution is at Treasury Management Onboarding.
Questions people ask
What is the FDIC remote deposit capture guidance?
It is the FDIC's copy of the same interagency FFIEC guidance, Risk Management of Remote Deposit Capture, issued January 14, 2009. The FDIC revised its copy in June 2026 to remove references to reputational risk; the risk assessment, suitability, contract and monitoring expectations stand.
Are there remote deposit capture regulations, or only guidance?
Both apply. The FFIEC document is supervisory guidance on risk management. The deposits themselves fall under the Check 21 Act, Regulation CC, Regulation J and state law, and Regulation CC includes a specific indemnity for image deposits of checks that have already been paid.
Does a bank have to visit a client before offering remote deposit capture?
Not always. The guidance says staff should include visits to the customer's location "when the level of risk warrants", and that for lower risk a bank may rely on the customer's self-assessment of its controls. The bank's written criteria should say which clients get which.
How long should a business keep checks after remote deposit?
The guidance sets no period. It requires the bank to make the client follow document management procedures from receipt until destruction or voiding, and to write the handling and retention procedures into the agreement. The period is the bank's to set.
Is remote deposit capture a third-party sender risk?
It can be. The guidance notes that when external parties transmit items by deposit capture on behalf of merchants and the items are converted into ACH transactions, they are effectively acting as third-party senders, which brings the bank's third-party sender oversight into play.